専任のIT担当者がいない職場で、
日々の安全とパソコン管理を無理なく続ける方法

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
pub enum PriorityLevel {
    P3RoutineMonthly,
    P2Standard24h,
    P1Urgent1h,
    P0CriticalImmediate,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AccountState {
    pub account_id_hash: [u8; 32],
    pub is_employed: bool,
    pub mfa_passkey_enabled: bool,
    pub days_since_last_login: u32,
    pub has_admin_privilege: bool,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct DriftFinding {
    pub account_id_hash: [u8; 32],
    pub priority: PriorityLevel,
    pub reason: &'static str,
}

pub fn audit_identity_drift(accounts: &[AccountState]) -> Vec<DriftFinding> {
    let mut findings = Vec::new();
    for acc in accounts {
        if !acc.is_employed {
            findings.push(DriftFinding {
                account_id_hash: acc.account_id_hash,
                priority: PriorityLevel::P0CriticalImmediate,
                reason: "Retired employee account still active; revoke session tokens immediately",
            });
            continue;
        }
        if acc.has_admin_privilege && !acc.mfa_passkey_enabled {
            findings.push(DriftFinding {
                account_id_hash: acc.account_id_hash,
                priority: PriorityLevel::P1Urgent1h,
                reason: "Privileged account lacks FIDO2/MFA protection",
            });
        } else if acc.days_since_last_login > 45 {
            findings.push(DriftFinding {
                account_id_hash: acc.account_id_hash,
                priority: PriorityLevel::P2Standard24h,
                reason: "Dormant account (>45 days inactive); review and suspend",
            });
        }
    }
    findings.sort_by(|a, b| b.priority.cmp(&a.priority));
    findings
}